Siemens SINEC NMS Path Traversal Vulnerability (CNVD-2024-27532)

Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. A path traversal vulnerability exists in Siemens SINEC NMS versions...

CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can...

CVE-2024-3025

The CVE-2024-3025 entry affects mintplex-labs/anything-llm, where the logo filename handling allows path traversal due to insufficient input validation. Attackers can reference files outside the restricted directory via the logo upload endpoint, exposing the application’s database and potentially...

Sipwise C5 NGCP Dashboard 安全漏洞

Sipwise C5 NGCP Dashboard is a management interface from Sipwise that is used to manage and monitor various features and services of the Sipwise C5 Next Generation Communication Platform NGCP. A security vulnerability exists in Sipwise C5 NGCP Dashboard versions prior to mr11.5.1, which stems fro...

nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)

A flaw was found in Node.js. The privateDecrypt API of the crypto library may allow a covert timing side-channel during PKCS1 v1.5 padding error handling. This issue revealed significant timing differences in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decry...

VulnCheck KEV: CVE-2023-49785

NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using...

PT-2024-18770 · Google · Google Drive

Name of the Vulnerable Software and Affected Versions: Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site plugin for WordPress versions up to, and including, 1.3.8 Description: The plugin is vulnerable to...

Improper Access Control

nautobot is vulnerable to Improper Access Control. The vulnerability is due to inadequate access control mechanisms where several Nautobot URL endpoints will not disclose any Nautobot data unless the configuration variable EXEMPTVIEWPERMISSIONS is modified from its default value, allowing...

Server Side Request Forgery (SSRF)

gradio is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to the /proxy route allowing users to proxy arbitrary URLs include potentially internal endpoints. Attackers can proxy arbitrary URLs by exploiting this vulnerability...

PT-2024-13700 · Stilog · Stilog Visual Planning

Name of the Vulnerable Software and Affected Versions: Stilog Visual Planning version 8 Description: An authentication bypass issue was found, allowing an unauthenticated attacker to obtain an administrative API token. Recommendations: For Stilog Visual Planning version 8, consider restricting...

SUSE CVE-2024-26651

In the Linux kernel, the following vulnerability has been resolved: sr9800: Add check for usbnetgetendpoints Add check for usbnetgetendpoints and return the error if it fails in order to transfer the error...

CVE-2024-26651

In the Linux kernel, the following vulnerability has been resolved: sr9800: Add check for usbnetgetendpoints Add check for usbnetgetendpoints and return the error if it fails in order to transfer the error...

DEBIAN-CVE-2024-26651

In the Linux kernel, the following vulnerability has been resolved: sr9800: Add check for usbnetgetendpoints Add check for usbnetgetendpoints and return the error if it fails in order to transfer the error...

UBUNTU-CVE-2024-26651

In the Linux kernel, the following vulnerability has been resolved: sr9800: Add check for usbnetgetendpoints Add check for usbnetgetendpoints and return the error if it fails in order to transfer the error...

gradio Server-Side Request Forgery vulnerability

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the...

GHSA-R364-M2J9-MF4H gradio Server-Side Request Forgery vulnerability

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the...

CVE-2024-2206 SSRF Vulnerability in gradio-app/gradio

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the...

CVE-2024-2206

CVE-2024-2206 describes an SSRF vulnerability in the gradio-app/gradio project where insufficient validation of user-supplied URLs in the /proxy route allows manipulation of the self.replica_urls set via the X-Direct-Url header on requests to the / and /config routes. This enables attackers to ad...

Gradio 代码问题漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. A code issue vulnerability exists in Gradio that stems from proxy routing that allows users to proxy arbitrary URLs, including internal endpoints...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to check usbnetgetendpoints in sr9800...